Firefox: full fingerprinting protection, hide the core fonts from sites

- fingerprintingProtection with every protection on except forced light
  mode: canvas/WebGL randomized, generic GPU name, UTC, fixed core count
- Accept-Language en-US, en (the common value)
- Firefox runs with its own fontconfig file that leaves out corefonts, so
  sites can't measure them; other apps keep them

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -30,7 +30,7 @@ My personal NixOS system configuration.
 | `modules/default-apps.nix` | MIME associations |
 | `modules/scripts.nix` | Custom scripts in `modules/scripts/` |
 | `modules/fastfetch.nix` | Installs `configs/fastfetch/config.jsonc` system-wide |
-| `modules/firefox.nix` | Firefox, with prefs from `configs/firefox/prefs.js` (reapplied each start, not locked) |
+| `modules/firefox.nix` | Firefox, with prefs from `configs/firefox/prefs.js` (reapplied each start, not locked), and its own font list without the Microsoft core fonts (against font fingerprinting) |
 | `configs/` | Plain app config files (Firefox prefs, fastfetch) used by the modules |
 
 ## NexoPass

configs/firefox/prefs.js

@@ -20,10 +20,36 @@
 // for that site only.
 pref("browser.contentblocking.category", "strict");
 
-// resistFingerprinting replaced by the fingerprintingProtection above. RFP
-// forced light mode, UTC time and English pages on every site.
+// Fingerprinting protection at full strength: everything resistFingerprinting
+// does (a Windows user agent and platform that agree, UTC time, a fixed core
+// count, the bundled font list, no precise GPU name, canvas noise...), but
+// switched on through fingerprintingProtection, because only that one takes
+// exceptions. The one exception: prefers-color-scheme isn't forced to light,
+// so sites still get dark mode.
+// To check it worked: coveryourtracks.eff.org should show Windows in both
+// User Agent and Platform, and timezone UTC.
 pref("privacy.resistFingerprinting", false);
-pref("privacy.spoof_english", 0);
+pref("privacy.fingerprintingProtection", true);
+pref("privacy.fingerprintingProtection.pbmode", true);
+pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-CSSPrefersColorScheme");
+
+// Ask sites for English pages the way most English-speaking browsers do
+// (en-US, en), so the language header doesn't stand out. en-GB would be
+// rarer, and rarer is what gets you tracked.
+pref("intl.accept_languages", "en-US, en");
+pref("privacy.spoof_english", 2);
+
+// Sites only see base system fonts, not the ones installed on top
+// (the Microsoft core fonts made the font list 1 in 9,481).
+pref("layout.css.font-visibility.standard", 1);
+pref("layout.css.font-visibility.trackingprotection", 1);
+pref("layout.css.font-visibility.private", 1);
+pref("layout.css.font-visibility.resistFingerprinting", 1);
+
+// WebGPU tells sites about the graphics card in detail. Off breaks some
+// sites (3D, AI demos, some games); uncomment to turn it off.
+// pref("dom.webgpu.enabled", false);
+
 // First-party isolation stays ON. Every existing cookie in this profile was
 // saved with a first-party tag; turning this off makes Firefox ignore them
 // all (logged out everywhere). Works alongside Strict mode.

modules/firefox.nix

@@ -1,8 +1,33 @@
 { config, pkgs, ... }:
 
+let
+  # Firefox's own font setup: every system font except the Microsoft core
+  # fonts. Sites measure which fonts are installed to fingerprint you, and
+  # Comic Sans, Impact, Georgia, Verdana... made that list 1 in 9,000.
+  # Only Firefox is affected: other apps still have corefonts. In Firefox,
+  # Arial, Times New Roman and Courier New render as Liberation (same
+  # letter widths), the rest fall back to Noto.
+  firefoxFonts = pkgs.writeText "firefox-fonts.conf" ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+    <fontconfig>
+      <include ignore_missing="no">/etc/fonts/fonts.conf</include>
+      <selectfont>
+        <rejectfont>
+          <glob>${pkgs.corefonts}/*</glob>
+        </rejectfont>
+      </selectfont>
+    </fontconfig>
+  '';
+in
 {
   programs.firefox = {
     enable = true;
+    # The wrapper sets FONTCONFIG_FILE when Firefox starts. (overrideAttrs
+    # keeps the package overridable, so the autoConfig below still applies.)
+    package = pkgs.firefox.overrideAttrs (old: {
+      makeWrapperArgs = old.makeWrapperArgs ++ [ "--set" "FONTCONFIG_FILE" "${firefoxFonts}" ];
+    });
     # Not locked: values are reapplied on every Firefox start, but can be
     # changed in the UI for the current session. (Read as text: the module
     # doesn't copy autoConfigFiles paths into the store.)